[trafficserver] 13/25: Fix heap-use-after-free on Http2Stream::destroy()

[zw...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

zwoop pushed a commit to branch 8.1.x
in repository https://gitbox.apache.org/repos/asf/trafficserver.git

commit b37bfde7c2b2903358684ecc379453c33673dab4
Author: Masaori Koshiba <ma...@apache.org>
AuthorDate: Mon Jan 27 13:36:01 2020 +0900

    Fix heap-use-after-free on Http2Stream::destroy()
    
    (cherry picked from commit ca6747102646080fe03046384488150ce93143d9)
    
    Conflicts:
    	proxy/http2/Http2Stream.cc
---
 proxy/http2/Http2Stream.cc | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/proxy/http2/Http2Stream.cc b/proxy/http2/Http2Stream.cc
index 5f9d6fe..2e11782 100644
--- a/proxy/http2/Http2Stream.cc
+++ b/proxy/http2/Http2Stream.cc
@@ -743,15 +743,18 @@ Http2Stream::destroy()
 
   // Safe to initiate SSN_CLOSE if this is the last stream
   if (parent) {
-    Http2ClientSession *h2_parent = static_cast<Http2ClientSession *>(parent);
-    SCOPED_MUTEX_LOCK(lock, h2_parent->connection_state.mutex, this_ethread());
+    cid = _proxy_ssn->connection_id();
+
+    Http2ClientSession *h2_proxy_ssn = static_cast<Http2ClientSession *>(parent);
+    SCOPED_MUTEX_LOCK(lock, h2_proxy_ssn->connection_state.mutex, this_ethread());
     // Make sure the stream is removed from the stream list and priority tree
     // In many cases, this has been called earlier, so this call is a no-op
-    h2_parent->connection_state.delete_stream(this);
+    h2_proxy_ssn->connection_state.delete_stream(this);
 
     // Update session's stream counts, so it accurately goes into keep-alive state
-    h2_parent->connection_state.release_stream(this);
-    cid = parent->connection_id();
+    h2_proxy_ssn->connection_state.release_stream(this);
+
+    // Do not access `_proxy_ssn` in below. It might be freed by `release_stream`.
   }
 
   // Clean up the write VIO in case of inactivity timeout